feat(auth)!: remove the public access-request endpoint

POST /auth/request-access had no caller left: the login page's form was
gone, and registration and a refused Google sign-in already land in the
same admin approval. A third public write path with no protection of
its own (owner decision, E34).

Its one guard moves to where every path passes: upsert_pending_invite no
longer opens a pending row for an address the env already lets in. The
registration path lacked it — registering b.ob@gmail.com beside an
env-granted bob@gmail.com opened a pending row, and is_allowed answers
from the invite rows once any exist, so the real owner was locked out.
The tests that drove the endpoint now drive registration or the shared
function.

backend/tests/test_mail_language.py

@@ -131,6 +131,12 @@ def test_the_lookup_is_canonical_like_every_other_identity_match(db, make_user):
 # --- capturing the signal at the one moment it exists ---------------------------------------------
 
 
+def _ask(db, lang: str) -> None:
+    """A pending request carrying the language it was made in — what a refused Google sign-in records
+    (with the locale Google reported), through the one function every entry point shares."""
+    auth_routes.upsert_pending_invite(db, "asking@example.com", lang)
+
+
 def test_registration_records_the_language_of_the_sign_up_page(db, client):
     r = client.post(
         "/auth/register", json={"email": "signup@example.com", "password": _PW, "lang": "hu"}
@@ -141,31 +147,16 @@ def test_registration_records_the_language_of_the_sign_up_page(db, client):
     assert (user.preferences or {}).get("language") == "hu"
 
 
-def test_an_access_request_records_the_language_it_was_made_in(db, client):
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
-        ).status_code
-        == 200
-    )
+def test_an_access_request_records_the_language_it_was_made_in(db):
+    _ask(db, "hu")
 
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
     assert inv.lang == "hu"
 
 
-def test_asking_again_from_another_language_updates_the_row(db, client):
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "en"}
-        ).status_code
-        == 200
-    )
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
-        ).status_code
-        == 200
-    )
+def test_asking_again_from_another_language_updates_the_row(db):
+    _ask(db, "en")
+    _ask(db, "hu")
 
     db.expire_all()
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
@@ -174,13 +165,8 @@ def test_asking_again_from_another_language_updates_the_row(db, client):
     assert db.execute(select(Invite)).scalars().all() == [inv]
 
 
-def test_an_unsupported_language_is_ignored_rather_than_stored(db, client):
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "../../etc"}
-        ).status_code
-        == 200
-    )
+def test_an_unsupported_language_is_ignored_rather_than_stored(db):
+    _ask(db, "../../etc")
 
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
     assert inv.lang is None
@@ -222,21 +208,15 @@ def test_the_confirmation_mail_is_written_in_the_accounts_language(db, client, m
 
 
 def test_the_approval_mail_answers_in_the_language_the_request_was_made_in(
-    db, client, make_user, as_user, monkeypatch
+    db, make_user, as_user, monkeypatch
 ):
     from app import email as email_mod
 
     monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: True)
     sent = _bodies(monkeypatch)
     admin = make_user(email="admin@example.com", role="admin")
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
-        ).status_code
-        == 200
-    )
+    _ask(db, "hu")
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
-    sent.clear()  # drop the admin notification; this test is about the reply to the requester
 
     r = as_user(admin).post(f"/api/admin/invites/{inv.id}/approve")
 
@@ -246,18 +226,13 @@ def test_the_approval_mail_answers_in_the_language_the_request_was_made_in(
     assert subject == mailtext.MAIL_TEXT["access_approved.subject"]["hu"]
 
 
-def test_a_denial_answers_in_that_language_too(db, client, make_user, as_user, monkeypatch):
+def test_a_denial_answers_in_that_language_too(db, make_user, as_user, monkeypatch):
     from app import email as email_mod
 
     monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: True)
     sent = _bodies(monkeypatch)
     admin = make_user(email="admin@example.com", role="admin")
-    assert (
-        client.post(
-            "/auth/request-access", json={"email": "asking@example.com", "lang": "hu"}
-        ).status_code
-        == 200
-    )
+    _ask(db, "hu")
     inv = db.execute(select(Invite).where(Invite.email == "asking@example.com")).scalar_one()
     sent.clear()